2144b7db2d458cac8f0c09890346ffe95e0287ac7750e8947694ce6b9083abc2

Sharing

Copy URL Twitter E-mail

General

Target
RewasdBypass.zip
Size 1.9MB
Sample260828-q9d1hsdb63
SHA256 2144b7db2d458cac8f0c09890346ffe95e0287ac7750e8947694ce6b9083abc2
MD5 f758009ee4999a08ab6397f43d5d9c51
SHA1 250353ee9bf85a546f82b38304b9b8b5c1e0eba5
SHA512 6169e8f2c8f2db88a19eea45d48d17251444f8e58f4022f599c7eedcaa2a99ca02cf5157f1c55bf5ad785b553ea1b72001e1f2278d1ab2199af443ec1f68046e
SSDEEP 49152:m+h8apVqo320CrbOsSHk8lRmFWLhmnsBt/VpkpTyGiqXn+0BQn5CsM/pL39d:Rh7pVqoMb8HdRm41msn/TkeqXn+Hn5CX
TLSH
T1D79533F05DA86380D23A8E315E672FB4A1AC12CE7447305D42E8D71E9A7AF4B097B74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Targets

- Target
  RewasdBypass.zip
- Size 1.9MB
- SHA256 2144b7db2d458cac8f0c09890346ffe95e0287ac7750e8947694ce6b9083abc2
- MD5 f758009ee4999a08ab6397f43d5d9c51
- SHA1 250353ee9bf85a546f82b38304b9b8b5c1e0eba5
- SHA512 6169e8f2c8f2db88a19eea45d48d17251444f8e58f4022f599c7eedcaa2a99ca02cf5157f1c55bf5ad785b553ea1b72001e1f2278d1ab2199af443ec1f68046e
- SSDEEP 49152:m+h8apVqo320CrbOsSHk8lRmFWLhmnsBt/VpkpTyGiqXn+0BQn5CsM/pL39d:Rh7pVqoMb8HdRm41msn/TkeqXn+Hn5CX
- TLSH
  T1D79533F05DA86380D23A8E315E672FB4A1AC12CE7447305D42E8D71E9A7AF4B097B74D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Bypass Rewasd.bat
- Size 40B
- SHA256 6f751a4fd086d081bd8601221c6c61c5fac8480d25926e89735cb0ebf14b1344
- MD5 84f45dad0568a94e9663f55c5c4fcc3d
- SHA1 789911d7c7f9af0ff002e1df20df1260d1492b35
- SHA512 e4b73f76be918e97e358a6ff8127a5a55ca4b8df28b3d53215d8edbe6bf07c56ad1347d5ef8954c78573c6ca4f992755f0fd6d4854edc5c10f20c37c33e57258
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral2
- Target
  Executables/AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Executables/AMIDEWINx64.EXE
- Size 453KB
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH
  T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Executables/DMI16.EXE
- Size 30KB
- SHA256 28e6e1908f2996af9b7a9930f13d4c770d6963425df0869ce4bcdb1442a4a917
- MD5 2a89d4e479351022ab8bd604030a76f3
- SHA1 ad1d39fd38fafaae4d77eed5f1c67f665686736d
- SHA512 0fb48aaeeedb5a96246ffd80c167f501ff2f5a08cf8d2dbf63373666c6f3394244395e05e49b68fedf02c2a3df75ad6ba4223f0066c350993233cf218da83e43
- SSDEEP 384:d2a1f/coJEQ88t5hDQ8o3wk4YMoURAzMbdLWxrqw8CKn6l3myGWstap/+ZU0KXy+:dLf/NWQltVoV4YfDOWxXd3my/cY
- TLSH
  T140E23E867A3A02F5E3B76EF45E0A972D7FEC214CC5FD64740639649FDB4082B3A86411
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Executables/DMIEDIT.EXE
- Size 3.2MB
- SHA256 5d37e5e7ce01549965bf2166adcba33d1e2c4bd2c90711032f3987b58452ce49
- MD5 fbaf6262fd84f9966338518d4de46fdd
- SHA1 291d481e3b42029e157e7c60febc8fe67cd50cf1
- SHA512 5d8cc6e1ab85fae8d9a5ffa83cecc2608b1fbbb28b9e80afe2dc6f7d46b657d489e03f75e42fc147d49313b3a41ad768fd0f320a905cbc41d767c0fc3c3d9d7e
- SSDEEP 49152:VOQ6nNB9ySqeDoVFixOA9DruNebQk9DtTKkuecMC+coEbyxvgg+lV:D6nwNomN1AKku1M2Jfj
- TLSH
  T1BBF57D5A67B840E4D4A6C278C4068A0BD3F3F8944B339B9F51D947AF1F736A24E2D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Executables/Script.bat
- Size 6KB
- SHA256 dc5602467823e4b187755584428a87ffc8b7c94bd83c8a59d69e9ef6beb873e3
- MD5 87ba8a8825c496e9540b3c75e4617a89
- SHA1 80e09885e4239d720a694d6ddf1b054495e0738f
- SHA512 47321764e647dbb412f06885d22134d4f080ce0f61a22ffaf80d1c92adb3bc31ac4c37a704d083113bd443aa27fed7840f59f7d17b2ce630f7702ed8abe6fdfc
- SSDEEP 96:5KVenI8hec8nMaNmHrBu4nKfaQ4nKfjn2V0rULUd3DRmdi:5KVenIPbniPnLfng2VFUd9mdi
- TLSH
  T116D197373DD191316921C3B3AF669064F357620765060F3C30AF42746B97E89AAFED8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Executables/UCOREDLL.DLL
- Size 112KB
- SHA256 78a4d8e5e8c33793e5a2020325d3a49e92e4826167742e93179bdacbf167b409
- MD5 8370f3114924ed6c53741de7a253625a
- SHA1 f7782d51e73526226a89229b4f3625c7ce43f3b3
- SHA512 5a13c0fb787366869fac57139fa2ebbd0c34a1bfa76c05ac879da60e534cbac694385f2b6120fdb6c7cf0e62cf4948efbdfde96e695a9d377f44eedb2e1b1398
- SSDEEP 1536:g+FKwswB29BLymvRwRvSpD0pQD61ShZT1Cw4cf0SbtsWFoYc0RkU:g8Vk9ymvyNMO4QqGeyqoLGL
- TLSH
  T123B39E217F91C4F2C099033C0E5B1B3A7FBE566CCE6959C3C7951E586E719B2AB3A201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Executables/UCORESYS.SYS
- Size 15KB
- SHA256 fd6f56189cd723b32fc06392867fcd5128e63d8b5801e4f7a83523f820531981
- MD5 9555d36fb21b993e5c4b98c2fc2b3671
- SHA1 210a98be7da32cea98618c5a9640c23ce518c0ee
- SHA512 3ec96ba6fca7a4aa45becfef84b23b12c305f34045ac1a15b22745289e33b9326103e853bad698434df772a76515e7e8109fa8724d65f0351ee380c16d888c60
- SSDEEP 384:pp4uPb5yDmnoMXP1oy5KYJLWd6jH9inbjJE:pp4sEmTDLAmH94b6
- TLSH
  T194623CD20B603432EDB70FB14486C7B7DEB392820D96855721349A8E1FC6BB12798D9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Executables/UCOREW64.SYS
- Size 14KB
- SHA256 a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200
- MD5 a17c58c0582ee560c72f60764ed63224
- SHA1 bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825
- SHA512 a820a3280da690980a9297fe1e62356eba1983356c579d1c7ea8d6f64bc710b11b0a659c5d6b011690863065541f5627c4e3bc13c02087493de7e63d60981063
- SSDEEP 384:q1ykKJX1BIAQ0r1IiFlYJLWd6jH9inbjJ+T:uygG1IiCLAmH94bgT
- TLSH
  T1DB621AD687212075D96B4F31A4CAD273AFB3B2412DCD51CF1130C5AE2ED6BB1179C89A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Executables/Volumeid.exe
- Size 228KB
- SHA256 22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3
- MD5 4d867033b27c8a603de4885b449c4923
- SHA1 f1ace1a241bab6efb3c7059a68b6e9bbe258da83
- SHA512 b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702
- SSDEEP 3072:OgfbRmDIHA98kK2WndTslNac+dA6YdqhsXCNZpp4GIoHZUFozD3zgJwDmr9u76v9:OSCgkKdcg9vCoaoMpcto
- TLSH
  T160347C11B2E48030E0F3167256B4D7620A7FBD729D36DA9EA7D84D4E4A74AC0E635B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Executables/Volumeid64.exe
- Size 165KB
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- TLSH
  T1A8F34A5233E410F9E1F3AB7089B55515EB36BCA65B34C78E162041AD5E72BD0EE38B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Executables/amifldrv64.sys
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH
  T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13